CWE-324

CVEs per yearBy the year they were published

1. 20191
2. 20223
3. 20231
4. 20248
5. 20255
6. 20264

Newest CVEs

• CVE-2026-39923

  Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

  Flarum · Flarum Framework

  Critical9.2
• CVE-2026-54787

  sigstore-go fails to check signature timestamps against a signing key's validity period

  sigstore · sigstore-go

  Low3.1
• CVE-2026-52809

  Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

  gogs · gogs

  Medium6.8
• CVE-2025-13723

  IBM Sterling Partner Engagement Manager Information Disclosure

  IBM · Sterling Partner Engagement Manager

  Medium5.3
• CVE-2025-33012

  IBM Db2 improper account lockout

  IBM · Db2

  Medium6.3
• CVE-2025-48813

  Virtual Secure Mode Spoofing Vulnerability

  Microsoft · Windows 10 Version 1809

  Medium6.3
• CVE-2023-5342

  Shim: expired secure boot certificate

  shim-x64

  Medium4.1
• CVE-2025-2291

  PgBouncer default auth_query does not take Postgres password expiry into account

  PgBouncer

  High8.1
• CVE-2025-31123

  Zitadel Expired JWT Keys Usable for Authorization Grants

  zitadel · zitadel

  High8.7
• CVE-2024-7318

  Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

  keycloak-core

  Medium4.8

Vendors it comes up for most

1. IBM5
2. Red Hat2
3. Asus1
4. Flarum1
5. Linux1
6. Microsoft1
7. Moodle1
8. Philips1
9. Pivotal1
10. The Conduit Contributors1